account: disallow password change

init.rb

@@ -7,6 +7,7 @@
 require 'redmine'
 require 'cas/account_controller_patch'
 require 'cas/application_controller_patch'
+require 'cas/user_patch'
 
 Redmine::Plugin.register :redmine_cas do
   name 'CAS Web Authentication'

lib/cas/account_controller_patch.rb

@@ -1,7 +1,6 @@
 require 'casclient'
 require 'casclient/frameworks/rails/filter'
 require 'dispatcher'
-require_dependency 'account_controller'
 
 # Patches Redmine's AccountController dinamically. Manages login and logout
 # through CAS.
@@ -52,5 +51,6 @@ def register_with_cas
 end
 
 Dispatcher.to_prepare do
+  require_dependency 'account_controller'
   AccountController.send(:include, CAS::AccountControllerPatch)
 end

lib/cas/application_controller_patch.rb

@@ -1,7 +1,6 @@
 require 'casclient'
 require 'casclient/frameworks/rails/filter'
 require 'dispatcher'
-require_dependency 'application_controller'
 
 # Patches Redmine's ApplicationController dinamically. Prepends a CAS gatewaying
 # filter.
@@ -50,5 +49,6 @@ def set_user_id
 end
 
 Dispatcher.to_prepare do
+  require_dependency 'application_controller'
   ApplicationController.send(:include, CAS::ApplicationControllerPatch)
 end

lib/cas/user_patch.rb

@@ -0,0 +1,28 @@
+require 'dispatcher'
+
+# Patches Redmine's User dinamically. Disallows password change.
+module CAS
+  module UserPatch
+    def self.included(base) # :nodoc:
+      base.send(:include, InstanceMethods)
+
+      base.class_eval do
+        unloadable # Mark as unloadable so it is reloaded in development
+
+        alias_method_chain :change_password_allowed?, :cas
+      end
+    end
+
+    module InstanceMethods
+      def change_password_allowed_with_cas?
+        CAS::CONFIG['enabled'] ? false : change_password_allowed_without_cas
+      end
+    end
+  end
+end
+
+Dispatcher.to_prepare do
+  require_dependency 'principal'
+  require_dependency 'user'
+  User.send(:include, CAS::UserPatch)
+end